{"id":"CVE-2024-55890","published":"2024-12-13T18:00:04Z","modified":"2024-12-13T18:48:43Z","title":"D-Tale allows Remote Code Execution through the Custom Filter Input","vendor":"man-group","product":"dtale","tier":"core","eol":null,"affectedVersions":[{"vendor":"man-group","product":"dtale","versions":["< 3.16.1"]}],"description":{"text":"D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.9,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0242,"percentile":0.84147,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-12-19","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/man-group/dtale/security/advisories/GHSA-832w-fhmw-w4f4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a","tags":["x_refsource_MISC"]},{"url":"https://github.com/man-group/dtale#custom-filter","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"dtale","vulnerableRanges":["<3.16.1"],"patched":["3.16.1"],"from":["GHSA-832w-fhmw-w4f4","PYSEC-2026-1320"],"provenance":"source"}],"advisories":[{"id":"GHSA-832w-fhmw-w4f4","url":"https://github.com/advisories/GHSA-832w-fhmw-w4f4","severity":"MODERATE","ecosystem":"PyPI","package":"dtale","vulnerableRanges":["<3.16.1"],"patched":["3.16.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-3447","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3447","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2026-08-24","earliestUrl":"https://github.com/gduma-phData/patch-CVE-2024-55890","repos":[{"name":"gduma-phData/patch-CVE-2024-55890","url":"https://github.com/gduma-phData/patch-CVE-2024-55890","stars":0,"created":"2026-08-24"}]},"nuclei":[{"id":"CVE-2024-55890","name":"D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection","severity":"critical","path":"http/cves/2024/CVE-2024-55890.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55890.yaml"}],"first":{"date":"2026-08-24","source":"PoC-in-GitHub","url":"https://github.com/gduma-phData/patch-CVE-2024-55890"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-12-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-55890","provenance":"source"},{"date":"2026-08-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/gduma-phData/patch-CVE-2024-55890","provenance":"source"}],"speed":{"daysToPublicExploit":619,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 316 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.83,"detail":"percentile 0.8415"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.83,"detail":"base score 6.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-man-group-dtale-cve-2023-46134","parents":[{"from":"CVE-2023-46134","to":"CVE-2024-55890","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["dtale/views.py"],"commits":["https://github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668","https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a"],"basis":"shared function","functions":["update_settings"]}]},{"from":"CVE-2024-21642","to":"CVE-2024-55890","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["dtale/views.py"],"commits":["https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2","https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a"],"basis":"shared function","functions":["update_settings"]}]}],"packageHistory":[{"cve":"CVE-2024-21642","published":"2024-01-05","fixed":"3.9.0","kev":false},{"cve":"CVE-2024-45595","published":"2024-09-10","fixed":"3.14.1","kev":false},{"cve":"CVE-2024-8862","published":"2024-09-14","fixed":"3.14.1","kev":false,"link":{"from":"CVE-2024-8862","to":"CVE-2024-55890","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:dtale","fromFixed":"3.14.1","toFixed":"3.16.1","daysApart":90},{"kind":"same-code","provenance":"machine","files":["dtale/views.py"],"commits":["https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a","https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8"],"basis":"shared file"}]}},{"cve":"CVE-2024-55890","published":"2024-12-13","fixed":"3.16.1","kev":false},{"cve":"CVE-2026-27194","published":"2026-02-21","fixed":"3.20.0","kev":false,"link":{"from":"CVE-2024-55890","to":"CVE-2026-27194","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:dtale","fromFixed":"3.16.1","toFixed":"3.20.0","daysApart":435}]}},{"cve":"CVE-2026-35052","published":"2026-04-06","fixed":"3.22.0","kev":false}],"package":"PyPI:dtale"}}